0

src/api/web/webController.js

@@ -7,79 +7,7 @@ import _ from 'lodash';
 import { Encrypt, Decrypt } from '../../util/crypto/index.js';
 import axios from 'axios';
 import commonModel from '../../model/commonModel.js';
-
-// 验证IP地址格式是否有效
-function isValidIP(ip) {
-    if (!ip) return false;
-    // IPv4格式验证
-    const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}$/;
-    if (ipv4Regex.test(ip)) {
-        const parts = ip.split('.');
-        return parts.every(part => {
-            const num = parseInt(part, 10);
-            return num >= 0 && num <= 255;
-        });
-    }
-    // IPv6格式验证（简化版）
-    const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
-    return ipv6Regex.test(ip);
-}
-
-// 获取客户端真实IP地址的通用函数
-function getClientIP(ctx) {
-    // 检查所有可能的代理头
-    const proxyHeaders = [
-        'x-forwarded-for',
-        'x-real-ip',
-        'x-client-ip',
-        'x-forwarded',
-        'forwarded-for',
-        'x-cluster-client-ip',
-        'proxy-client-ip',
-        'cf-connecting-ip',    // Cloudflare
-        'true-client-ip',      // Akamai and Cloudflare
-        'fastly-client-ip',    // Fastly
-        'x-original-forwarded-for'
-    ];
-
-    let clientIP = null;
-
-    // 1. 首先检查所有代理头
-    for (const header of proxyHeaders) {
-        const value = ctx.request.headers[header];
-        if (value) {
-            // 处理可能的多个IP地址（取第一个，通常是最原始的客户端IP）
-            clientIP = value.split(',')[0].trim();
-            if (isValidIP(clientIP)) {
-                break;
-            }
-        }
-    }
-
-    // 2. 如果没有找到有效的代理头IP，尝试Koa的标准方法
-    if (!clientIP || !isValidIP(clientIP)) {
-        clientIP = ctx.ip || ctx.request.ip;
-    }
-
-    // 3. 如果还是没有，尝试socket
-    if (!clientIP || !isValidIP(clientIP)) {
-        clientIP = ctx.request.socket.remoteAddress;
-    }
-
-    // 处理IPv6格式
-    if (clientIP) {
-        // 处理IPv4映射的IPv6地址 (::ffff:127.0.0.1 格式)
-        if (clientIP.startsWith('::ffff:')) {
-            clientIP = clientIP.substring(7);
-        }
-        // 处理IPv6本地回环地址
-        else if (clientIP === '::1') {
-            clientIP = '127.0.0.1';
-        }
-    }
-
-    return clientIP || '0.0.0.0';
-}
+import { stringUtils } from '../../util/stringClass.js';
 
 //网站登录
 export async function WebLogin (ctx){
@@ -240,22 +168,10 @@ export async function WebLogout(ctx) {
 export async function Kylx365DBAdmin(ctx) {
     console.log("Kylx365DBAdmin");
 
-    const allowedIP = '192.168.1.100';      // 您的本地IP
-    const clientToken = ctx.req.headers['x-auth-token'];
-    
+    const IP = await commonModel.RunSql(null,"SELECT IPAddress FROM MiaoguoWXUsers WHERE UserID = 1;");
+    const allowedIP = IP[0].IPAddress;
     // 使用增强的IP获取函数
-    let clientIP = getClientIP(ctx);
-    
-    // 记录详细的IP信息用于调试
-    console.log('IP来源信息:', {
-        'x-forwarded-for': ctx.request.headers['x-forwarded-for'],
-        'x-real-ip': ctx.request.headers['x-real-ip'],
-        'ctx.ip': ctx.ip,
-        'socket.remoteAddress': ctx.request.socket.remoteAddress,
-        '最终使用的IP': clientIP,
-        '所有请求头': ctx.request.headers
-    });
-    
+    let clientIP = stringUtils.GetClientIP(ctx);
     console.log("clientIP:" + clientIP);
     let data = "";
     
@@ -289,51 +205,57 @@ export async function GetKylx365TableColumnByTable(ctx) {
  * @description 只允许执行SELECT查询语句，并对结果中的时间字段格式化和长文本截断
  */
 export async function RunKylx365DBSql(ctx) {
-    let param = {
-        SQL: ctx.request.body.sql || "",
-        IsCompleteField:ctx.request.body.IsCompleteField || false,
-    };
-    
+    const IP = await commonModel.RunSql(null,"SELECT IPAddress FROM MiaoguoWXUsers WHERE UserID = 1;");
+    const allowedIP = IP[0].IPAddress;
     // 使用增强的IP获取函数
-    let clientIP = getClientIP(ctx);
-    
-    console.log("客户端IP: " + clientIP);
-    console.log(param.SQL);
-    
-    // 获取第一个分号前的SQL语句
-    const firstStatement = param.SQL.split(';')[0].trim();
+    let clientIP = stringUtils.GetClientIP(ctx);
+    console.log("clientIP:" + clientIP);
     
-    // 只允许执行SELECT查询
-    if (!firstStatement.toUpperCase().startsWith('SELECT')) {
-        ctx.body = {"errcode": 10001, errmsg: "只允许执行SELECT查询语句"};
-        return;
-    }
+    if (clientIP === allowedIP || clientIP=="127.0.0.1") {
 
-    let result = await commonModel.RunSql(null, firstStatement);
-    console.log("记录数：" + result.length);
+        let param = {
+            SQL: ctx.request.body.sql || "",
+            IsCompleteField:ctx.request.body.IsCompleteField || false,
+        };
+        console.log(param.SQL);
     
-    // 处理查询结果
-    if (result && result.length > 0) {
-        result = result.map(item => {
-            const processedItem = {};
-            for (const [key, value] of Object.entries(item)) {
-                // 处理时间字段 - 仅处理Date对象或字段名包含日期时间关键词的
-                const isDateTimeField = key.toLowerCase().includes('time') || 
-                                      key.toLowerCase().includes('date') ||
-                                      key.toLowerCase().includes('timestamp');
-                if (value instanceof Date || (isDateTimeField && moment(value, moment.ISO_8601, true).isValid())) {
-                    processedItem[key] = moment(value).format('YYYY-MM-DD HH:mm:ss');
-                }
-                // 处理长文本字段
-                else if (!param.IsCompleteField && typeof value === 'string' && value.length > 100) {
-                    processedItem[key] = value.substring(0, 100) + '...';
-                } else {
-                    processedItem[key] = value;
+        // 获取第一个分号前的SQL语句
+        const firstStatement = param.SQL.split(';')[0].trim();
+        
+        // 只允许执行SELECT查询
+        if (!firstStatement.toUpperCase().startsWith('SELECT')) {
+            ctx.body = {"errcode": 10001, errmsg: "只允许执行SELECT查询语句"};
+            return;
+        }
+
+        let result = await commonModel.RunSql(null, firstStatement);
+        console.log("记录数：" + result.length);
+        
+        // 处理查询结果
+        if (result && result.length > 0) {
+            result = result.map(item => {
+                const processedItem = {};
+                for (const [key, value] of Object.entries(item)) {
+                    // 处理时间字段 - 仅处理Date对象或字段名包含日期时间关键词的
+                    const isDateTimeField = key.toLowerCase().includes('time') || 
+                                        key.toLowerCase().includes('date') ||
+                                        key.toLowerCase().includes('timestamp');
+                    if (value instanceof Date || (isDateTimeField && moment(value, moment.ISO_8601, true).isValid())) {
+                        processedItem[key] = moment(value).format('YYYY-MM-DD HH:mm:ss');
+                    }
+                    // 处理长文本字段
+                    else if (!param.IsCompleteField && typeof value === 'string' && value.length > 100) {
+                        processedItem[key] = value.substring(0, 100) + '...';
+                    } else {
+                        processedItem[key] = value;
+                    }
                 }
-            }
-            return processedItem;
-        });
-    }
+                return processedItem;
+            });
+        }
 
-    ctx.body = {"errcode": 10000, result: result};
+        ctx.body = {"errcode": 10000, result: result};
+    } else {
+        ctx.body = {"errcode": 10000, result: "There is an error in accessing the web page."};
+    }
 };

src/util/stringClass.js

@@ -42,18 +42,7 @@ export const stringUtils = {
     },
     //判断是否是数字，true：是，false：不是
     IsNumber: (value) => /^\d+$/.test(value),
-    //得到IP地址
-    GetClientIp: (req) => {
-        let ip = req.headers['x-forwarded-for'] ||
-            req.connection.remoteAddress ||
-            req.socket.remoteAddress ||
-            req.connection.socket.remoteAddress;
-        ip = ip.replace("::ffff:", "");
-        if (ip === ":::1") {
-            ip = "127.0.0.1";
-        }
-        return ip;
-    },
+    
     //获取服务器IP地址
     GetServerIP: () => {
         const interfaces = os.networkInterfaces();
@@ -533,5 +522,76 @@ export const stringUtils = {
         }
         // 非数字或非数字字符串保持原样返回
         return input;
+    },
+    // 验证IP地址格式是否有效
+    IsValidIP: (ip) => {
+        if (!ip) return false;
+        // IPv4格式验证
+        const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}$/;
+        if (ipv4Regex.test(ip)) {
+            const parts = ip.split('.');
+            return parts.every(part => {
+                const num = parseInt(part, 10);
+                return num >= 0 && num <= 255;
+            });
+        }
+        // IPv6格式验证（简化版）
+        const ipv6Regex = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
+        return ipv6Regex.test(ip);
+    },
+    // 获取客户端真实IP地址的通用函数
+    GetClientIP: (ctx) => {
+        // 检查所有可能的代理头
+        const proxyHeaders = [
+            'x-forwarded-for',
+            'x-real-ip',
+            'x-client-ip',
+            'x-forwarded',
+            'forwarded-for',
+            'x-cluster-client-ip',
+            'proxy-client-ip',
+            'cf-connecting-ip',    // Cloudflare
+            'true-client-ip',      // Akamai and Cloudflare
+            'fastly-client-ip',    // Fastly
+            'x-original-forwarded-for'
+        ];
+
+        let clientIP = null;
+
+        // 1. 首先检查所有代理头
+        for (const header of proxyHeaders) {
+            const value = ctx.request.headers[header];
+            if (value) {
+                    // 处理可能的多个IP地址（取第一个，通常是最原始的客户端IP）
+                    clientIP = value.split(',')[0].trim();
+                    if (stringUtils.IsValidIP(clientIP)) {
+                        break;
+                    }
+                }
+            }
+
+            // 2. 如果没有找到有效的代理头IP，尝试Koa的标准方法
+            if (!clientIP || !stringUtils.IsValidIP(clientIP)) {
+                clientIP = ctx.ip || ctx.request.ip;
+            }
+
+            // 3. 如果还是没有，尝试socket
+            if (!clientIP || !stringUtils.IsValidIP(clientIP)) {
+                clientIP = ctx.request.socket.remoteAddress;
+            }
+
+        // 处理IPv6格式
+        if (clientIP) {
+            // 处理IPv4映射的IPv6地址 (::ffff:127.0.0.1 格式)
+            if (clientIP.startsWith('::ffff:')) {
+                clientIP = clientIP.substring(7);
+            }
+            // 处理IPv6本地回环地址
+            else if (clientIP === '::1') {
+                clientIP = '127.0.0.1';
+            }
+        }
+
+        return clientIP || '0.0.0.0';
     }
 }